2

We are trying to use a package released by a commercial entity for use with one of their reporting software. I think it was closed source at one point then they converted it to a "Community" release and re-released it as a open source project on Github.

Now, the problem I'm facing is that the project is released under Apache 2.0 license but when I looked through the sources, some of the files under the "lib" folders have "CC BY-NC-SA" license at the top of the source file like this:

/**
 * CC BY-NC-SA License
 * (...) by (...) is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
 * Based on a work at http://github.com/(...) 
 *
 */

How does this work in terms of licensing? Does this make the whole project Non-Commercial? Or, does this get overridden by the Apache 2.0 license at the project level? By the way, the author of the source mentioned above is also part of the team that released the top level project.

Improve this question
1
  • If the reposition is public, you might want to link to it in this question
    – planetmaker
    Oct 2, 2021 at 7:44

1 Answer 1

Reset to default
6

There is no universal rule. You have to file a bug and ask.

In general, it is probably safest to assume that the most restrictive or most specific license terms apply, unless there is some indication that the author intended to dual-license (i.e. that they wanted to let you choose which license terms to follow). In this case, that means you're probably safest in assuming that the individual files are CC-BY-NC-SA as indicated, and not under the Apache license. It is possible that the author(s) intended to let you choose between the Apache license and the CC-BY-NC-SA license, but this would make very little sense as the Apache license is much less restrictive than CC-BY-NC-SA.

The project really should have some sort of README or LICENSE file which explains these issues more explicitly. If they have a copy of the Apache license in the project root, but some of the individual files have a different license, then it's unclear what the Apache license is meant to apply to. If you can't find any clear explanation of the licensing terms and what falls under them, you should file a bug and ask for this information to be documented somewhere.

Finally, note that Creative Commons licenses were not intended to apply to software. Using them for software, as this author has apparently done, is generally not recommended. In particular, the ShareAlike condition does not require licensees to release their source code, unlike (say) the GPL, so ShareAlike licenses are less effective than the GPL in most contexts. This isn't really something you can fix, but the authors of this software should probably reconsider their choice of license.

Improve this answer
12
  • Thank you for the answer. I have created an issue in their github repository. It's been a week and they have not provided any response. I will have to see if there is a way to contact them more directly.
    – blissfool
    Oct 1, 2021 at 21:32
  • You should know that in the US, restrictions on use in licenses have no effect. See 17 USC 106 which lists the six things you need permission or a license to do with a copyrighted work. You can simply refuse to agree to the license and you still have all the rights to the normal use of the work because US law doesn't restrict normal use to just the copyright holder or licensees. Just as you don't need a license to read a book you lawfully acquired, you don't need a license to use a library you lawfully acquired.
    – David Schwartz
    Oct 4, 2021 at 19:02
  • @DavidSchwartz: In this context, "using" a library means creating a piece of software which dynamically or statically links to that library. Static linking almost certainly implicates at least one of the rights in 17 USC 106 because it requires you to incorporate the entire library as part of the software. Dynamic linking is contended to create a derivative work, but there is no clear legal precedent for or against this position. Regardless, the "use" of a library without actually doing some kind of linking is not meaningful because libraries do not have other reasonable uses.
    – Kevin
    Oct 4, 2021 at 19:07
  • @Kevin I agree with everything you've said. I think you may think it contradicts something I said, but it doesn't. Yes, the right to ordinary use might sometimes include things that would, if not part of ordinary use, implicate a right in 17 USC 106. Nevertheless, ordinary use is permitted. Once you lawfully own a work, you have the right to its ordinary use. You don't need a license to use a work you lawfully possess in the ordinary and expected ways -- that's what you acquire when you acquire the work.
    – David Schwartz
    Oct 4, 2021 at 19:35
  • @DavidSchwartz: There are two cases: Either you distribute the resulting software, or you don't. If you don't, then neither of the licenses I discuss in this answer purports to impose any restrictions on you in the first place (nor does the GPL, or indeed any open source license, with some odd exceptions like the AGPL). If you do, then you're potentially engaged in the distribution of a derivative work (and/or copies thereof), which is not "ordinary use" under any theory of law I have ever heard of.
    – Kevin
    Oct 4, 2021 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.